Paranoid Penguin - Building a Transparent Firewall with Linux, Part II

Now that you understand how this setup will look, before and after
firewalling, let's talk about firewall hardware. This article series
isn't the first time I've tinkered with transparent Linux firewalls.
Years ago when I started researching passive network monitoring, I set
up several “white-box” PCs that each had multiple network
interfaces and could monitor and restrict network traffic transparently.

When I began researching this new series, my first thought was to
resuscitate one of those old systems or build a new one. That seemed
like a waste of electricity, however. Why deal with case and CPU fans,
hard drives and so forth, for something usually handled by optimized
network appliances?

This line of thinking brought me to the idea of industrial/embedded
platforms—small, diskless computers running an Atom or ARM processor. But
the cost of these, especially models with multiple network interfaces,
is similar to that of PCs, and I wanted to spend as little as possible.

Then it dawned on me that this is exactly what OpenWrt was designed
for! In case you're unfamiliar with it, OpenWrt is a free Linux
distribution designed to run on commodity WLAN gateways and broadband
routers, such as Linksys' venerable WRT54G series. On the one hand, I'm not
much interested in covering WLAN firewalling in this series (although once
it's configured properly, a firewall with a WLAN interface can treat it
just the same as any other network interface). But on the other hand,
the WRT54G is basically a small computer with five network interfaces
plus WLAN. Small memory and slow CPU aside, it should make an ideal
Linux firewall platform.

This is how I settled on the Linksys WRT54GL wireless-G broadband router,
which cost me only $58, as the test platform for my transparent
Linux firewall experiments. How well does it perform and scale, and
how stable is it? Time will tell. I would guess the short answer is
“good enough for home use, but not quite Fortune-500-ready”. Besides,
it's bright blue, cheap and cool.

If this sort of hardware hacking isn't quite your cup of tea, I hope you'll
stay with me through the series anyhow, because most of the real iptables
magic we'll be working in building our transparent firewalling examples
is applicable to any Linux system with multiple network interfaces.

One last note on hardware selection. As a Linux firewall platform,
a laptop computer makes a nice middle ground between broadband routers
and desktop PCs with respect to cost and power consumption, and you
easily can add network interfaces to one via USB. Although even a used laptop
will cost more than an OpenWrt-compatible broadband router, it will be
able to run practically any mainstream Linux distribution, giving you
access to a much wider range of software than you can run on OpenWrt.

If you opt for the laptop approach, be sure to select USB Ethernet
interfaces that support USB 2.0 (which is necessary for anything
approaching acceptable performance—USB 2.0 operates at 480Mbps,
but USB 1.1 is only 12Mbps, and 1.0 is a tiny 1.5Mbps!) and, of course,
that are Linux-compatible!

I've had good luck with the D-Link DUB-E100, a USB 2.0, Fast Ethernet
(100Mbps) interface. It's supported under Linux by the usbnet and
asix kernel modules. (My Ubuntu system automatically detects my DUB-E100
interfaces and loads both modules.)

Installing OpenWrt on a Linksys WRT54GL

Back to my OpenWrt adventure, indulge me for a few more
paragraphs (plus a few more next month) before we tackle firewall
configuration proper. The first step in choosing hardware to use with
OpenWrt is consulting the OpenWrt Web site to see what's supported by
current versions of OpenWrt (see Resources).

If you choose a Linksys device, which probably is a good choice given
that the OpenWrt Project began around the Linksys WRT54G product line,
be sure to choose a model whose number ends in L, which indicates
“Linux-compatible”. As I mentioned earlier, I chose the Linksys WRT54GL,
still available at the time of this writing from various on-line retailers.

The OpenWrt Table of Hardware provides links to other OpenWrt pages
giving detailed instructions on installing and configuring OpenWrt on
each supported device. In the case of my Linksys WRT54GL, I followed
these steps to install OpenWrt:

3. I connected to the WRT54GL by typing the URL
http://192.168.1.1/Upgrade.asp in the browser of a laptop connected to
one of the WRT54GL's Ethernet ports, not its “Internet” port.
Note that
my laptop's network interface was configured to use DHCP and actually
pulled its IP address via DHCP from the WRT54GL. Hence, it was assigned
an IP in the subnet 192.168.1.0/24, which the WRT54GL uses by default.

4. I “upgraded” the WRT54GL's firmware with the file
openwrt-54g-squashfs.bin and waited a few minutes for the upload to
complete and for the WRT54GL to reboot with the new firmware.

5. Finally, from my laptop, I ran the command telnet
192.168.1.1
to connect to the WRT54GL, and I was greeted with this message and prompt:

Success! Not only had I successfully turned my inexpensive broadband
router into a five-Ethernet-interfaced Linux computer, I'd also learned
the recipe for a refreshing cocktail, the Kamikaze. Looking around,
I was pleased to discover a fairly ordinary Linux environment.

The only thing missing was a Linux 2.6 kernel. I had one more task
before proceeding to turning this blue beastie into a firewall—upgrading its kernel. According to the OpenWrt Wiki, you can do so only
after first installing a 2.4 kernel (which I'd just done) and changing
some NVRAM settings like so via telnet:

This done, on my laptop, I downloaded the latest Backfire
version of OpenWrt (v. 10.03 at the time of this writing) from
downloads.openwrt.org/backfire/10.03/brcm47xx. The file I
downloaded for my WRT54GL was openwrt-wrt54g-squashfs.bin.

To flash it to my WRT54GL, I opened a command window on my Windows laptop,
navigated to the directory to which I'd just downloaded my new firmware
image, and without pressing Enter just yet, typed the following command:

tftp -i 192.168.1.1 PUT openwrt-wrt54g-squashfs.bin

Before pressing Enter, I unplugged my WRT54GL, waited a few seconds,
plugged it back in, and immediately pressed Enter in my Windows laptop's
command window to execute that tftp command. After a few seconds, I got a
“Transfer successful” message. The router decompressed the new firmware
image, and it rebooted itself to Backfire. When I telneted back in
to the router, I was greeted with a new banner:

Again, success! Now, not only is my WRT54GL broadband router running Linux,
it's also running a reasonably current 2.6 kernel. I'm definitely ready to
start configuring this machine for its new stealth firewall duties.

Comment viewing options

Glad to see someone else is trying to tackle this issue. Over the winter break/holidays, I resdesigned my home/remote-office/spouses-business networks from three seperate layer-3 firewalls to a single layer-3 network. I was hoping to utilize the fifth port on two of the wireless routers. I have been trying to get my Cisco LinkSys WRT320N to keep broadcast/multi-cast media traffic local. I will look into the OpenWRT to attempt layer-2 firewall the WRT320N.

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.